USGFlex200H blocking Macs from connecting to Windows server

Options
JackOBrien
JackOBrien Posts: 6 image  Freshman Member
First Comment Friend Collector Fourth Anniversary
in USG FLEX H Series

Macs use SMB to connect to windows servers, our canon copiers also use SMB for scanning documents to a Windows server. Our old Zyxel firewall died, I've installed the new one (200H) and it's blocking all SMB traffic. The Macs can't connect to the Windows server and the Canon copiers can't scan to the Windows server. My previous USGFlex200 (not H) let this traffic through. In the 200H, every damned thing has been moved/renamed/complicated and I just can't get it to work. Surely someone else has has this experience? Can you help me on setting up maybe port passthrough or how to set up a security object/service and implement it? I would appreciate it so much.

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Options

    Hi @JackOBrien

    It seems like the device and server are in different IP subnet/VLAN interface. Please help to share the topology and enable Zyxel support access so we can help to check. Please also let us know the organization's name and site name.

    https://community.zyxel.com/en/discussion/14234/nebula-how-to-turn-on-zyxel-support-access
    Zyxel Melen


  • JackOBrien
    JackOBrien Posts: 6 image  Freshman Member
    First Comment Friend Collector Fourth Anniversary
    Options

    "It seems like the device and server are in different IP subnet/VLAN interface."

    Um, no. The devices in question are all on 192.168.0.x.

    Why would you assume otherwise?

    I had to pull the USBFlex200H out of service and install the old router/firewall, which works as expected. I am going to reset the 200H and start over from scratch. I think that the conversion utility from the USGFlex200 =⇒> USGFlex200H made a mess of things. We'll see

  • Maverick87
    Maverick87 Posts: 211 image  Master Member
    5 Answers First Comment Friend Collector
    Options

    Hi @JackOBrien,

    can you share the screenshot of the logs that you show?

    Thank you

  • PeterUK
    PeterUK Posts: 4,608 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited July 28
    Options

    If all devices on 192.168.0.x. they be on a switch yes? because of this SMB would never need to go to the USG and Zyxel USG with port group ack as a switch so that too means it never goes to the USG. everything would be at the switch level for SMB the only way to make traffic go through USG would be if the switch was made to egress ARP to the USG and the USG did proxy ARP which is what I do on VPN300.

    to be sure thats not the care if you have a old backup file of the FLEX 200 search for ip proxy-arp and check your switch setup

  • Maverick87
    Maverick87 Posts: 211 image  Master Member
    5 Answers First Comment Friend Collector
    Options

    @PeterUK I've excluded a switch because Jack don't mension it.

    Can be another problem; as Jack said, seems that the problem is at firewall layer, but if is on the same subnet, probably the problem can be a security option or something else enabled.

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,992 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Options
    https://community.zyxel.com/en/discussion/comment/86075#Comment_86075

    In some of SMB network, the server will be located in a server subnet which separates with office PCs and printers.

    Since the devices are in the same subnet, could you share your network topology? Because in the same subnet, firewall default security policy will not block the LAN-to-LAN traffic.

    Please also enable Zyxel support access so we can help to check your configuration. And also let us know the organization's name and site name.

    Zyxel Melen


  • JackOBrien
    JackOBrien Posts: 6 image  Freshman Member
    First Comment Friend Collector Fourth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/86079#Comment_86079

    Thanks for your response Peter. Yes, they're on a switch but the switches shouldn't have to be reconfigured because I'm changing out the firewall. I have the USGFLEX200 configuration file, when I use the Zyxel config file converter (to go from USGFLEX200 =⇒> USGFLEX200H) it winds up with 800 errors ("require manual attention"). Nothing on the network changed except the firewall so I'm not about to go mucking about changing other settings. You know, for sanity and all.

  • JackOBrien
    JackOBrien Posts: 6 image  Freshman Member
    First Comment Friend Collector Fourth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/86089#Comment_86089

    I will be back on site this evening or the next few evenings, I will enable Zyxel support so that you can look at it. FWIW, all four Canon copiers use SMB to "Scan to Folder" (to the Windows Server and the Macintoshes also use SMB to connect to the Windows Server. Those two items don't work for the same reason. I personally think that the configuration file is a mess, there are too many errors in it after the conversion from the USGFLEX200 =⇒> USGFLEX200H. We'll see.

  • JackOBrien
    JackOBrien Posts: 6 image  Freshman Member
    First Comment Friend Collector Fourth Anniversary
    Options
    https://community.zyxel.com/en/discussion/comment/86078#Comment_86078

    I had reset the device back to factory defaults. I'll check the logs this evening and I'll screen shot them if I'm still having the problem. Thank you.

  • PeterUK
    PeterUK Posts: 4,608 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited August 4
    Options

    Well if they are on the same subnet and by a switch then the USG is no involved like

    192.168.0.3 goes to switch to do ARP for 192.168.0.6 then SMB traffic is send by the switch it never goes to the USG unless like I said proxy ARP which your likely not using.

    so if you put the old FLEX on you likely find SMB still not working.

    some other possibility's your client has firewall rules and old FLEX had fix MAC/IP binding or windows on seeing a new gateway MAC changed it network profile messing up SMB

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）